Built-in Streamable HTTP MCP server for Dagu that lets AI agents read workflow state, inspect DAG specs and logs, preview or apply workflow changes, and start, enqueue, retry, or stop DAG runs.
Dagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps., The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs., API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access., Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions., Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
Privacy notes
DAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client., Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context., Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted., Any workflow state returned through the MCP client may be sent onward to the configured model provider.
Author
dagucloud
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-06
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 4 privacy notes across 4 risk areas. Review closely: credentials & tokens, network access, third-party handling.
4 areas
SafetyNetwork accessDagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps.
SafetyExecution & processesThe MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs.
SafetyCredentials & tokensAPI keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access.
SafetyCredentials & tokensWorkflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions.
SafetyNetwork accessKeep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
PrivacyCredentials & tokensDAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client.
PrivacyCredentials & tokensDagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted.
PrivacyThird-party handlingAny workflow state returned through the MCP client may be sent onward to the configured model provider.
Safety notes
Dagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps.
The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs.
API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access.
Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions.
Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
Privacy notes
DAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client.
Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context.
Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted.
Any workflow state returned through the MCP client may be sent onward to the configured model provider.
Prerequisites
Dagu installed from Homebrew, GitHub Releases, npm, Docker/GHCR, Helm, or another upstream-supported installation path.
A running Dagu HTTP server with the built-in MCP endpoint enabled through the normal server path.
MCP client that supports Streamable HTTP server configuration.
API key with MCP surface access when Dagu authentication is enabled.
Existing DAG/workflow directory and policy for which agents may read, change, start, retry, stop, or enqueue workflow runs.
Schema details
Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
25 minutes
Difficulty
advanced
Full copyable content
brew install dagu
About this resource
Content
Dagu is a local-first workflow engine for defining and operating YAML DAGs with
a Web UI, single-binary deployment, and no required external DBMS. Its built-in
MCP server exposes a compact Streamable HTTP interface for AI agents to read
Dagu state, inspect DAG specs and logs, preview or apply workflow changes, and
control DAG runs.
The MCP implementation registers three core tools: dagu_read for read-only
state, specs, run details, and logs; dagu_change for previewing or applying
DAG YAML changes; and dagu_execute for starting, enqueueing, retrying, or
stopping DAG runs.
These sources were reviewed on 2026-06-06. Prefer the live repository,
README, license notes, MCP server implementation, MCP docs, authentication
docs, auditability docs, installation docs, deployment model docs, secrets docs,
GitHub Releases, and GHCR package page for current setup, endpoint, tools, API
key, and deployment behavior.
Features
Expose a built-in Streamable HTTP MCP endpoint from the running Dagu server.
Read DAG lists, DAG details, DAG specs, run details, run logs, and Dagu MCP
reference resources.
Preview or apply DAG YAML changes through dagu_change.
Start, enqueue, retry, or stop workflow runs through dagu_execute.
Use resources such as current DAG specs and run logs.
Use prompts for creating DAGs, editing DAGs, and debugging failed runs.
Scope API keys to the MCP surface when Dagu authentication is enabled.
Keep MCP-triggered actions visible through Dagu's audit and Web UI surfaces.
Installation
Install Dagu through an upstream-supported path such as Homebrew, GitHub
Releases, npm, Docker/GHCR, or Helm. For Homebrew:
brew install dagu
Start the Dagu server, enable authentication if required for your environment,
and create an API key that is allowed to use the MCP surface. A sanitized MCP
client configuration looks like:
Follow the upstream MCP clients and authentication docs for the exact local or
remote endpoint, API key setup, and client-specific configuration.
Use Cases
Let an AI coding agent inspect workflow state and logs before editing a DAG.
Draft new Dagu YAML workflows from a natural-language goal, then preview
validation before applying.
Debug failed workflow runs by reading run metadata and logs through MCP.
Start or enqueue approved workflow runs from Claude, Codex, Gemini CLI, or
another MCP-capable agent.
Operate scheduled automation from a local, self-hosted, managed, or hybrid
Dagu deployment.
Safety and Privacy
Dagu can run real automation, including shell commands, Docker steps,
Kubernetes Jobs, SSH actions, SQL queries, HTTP requests, file operations,
notifications, and AI-agent harness steps. Treat dagu_change and
dagu_execute as high-impact tools. Require review before applying workflow
changes, launching production jobs, retrying expensive work, stopping incident
response workflows, or changing schedules and credentials.
MCP clients can see DAG specs, logs, parameters, outputs, resource references,
and audit context. Review log redaction, secrets management, API key scope, and
model-provider exposure before giving an agent access to sensitive workflows or
customer data.
Duplicate Check
No dagucloud/dagu entry, Dagu MCP Server entry, Dagu workflow MCP entry, or
matching source URL was found in content/mcp.
Show that Dagu MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/dagu-mcp-server)
How it compares
Dagu MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
Built-in Streamable HTTP MCP server for Dagu that lets AI agents read workflow state, inspect DAG specs and logs, preview or apply workflow changes, and start, enqueue, retry, or stop DAG runs.
Hosted Streamable HTTP MCP server for creating, inspecting, testing, publishing, unpublishing, analyzing, and styling Dreamlit notification workflows from AI clients.
Hosted streamable-HTTP MCP server that exposes inference.sh platform tools for running apps, managing tasks, proxying external MCP connectors, and calling hundreds of hosted AI models from Claude Code, Cursor, and other MCP clients.
MCP transport bridge that converts between stdio, SSE, and Streamable HTTP so local MCP clients can reach remote servers, or remote clients can reach local stdio servers.
✓Dagu is a workflow engine; MCP access can expose shell commands, Docker containers, Kubernetes Jobs, SSH commands, SQL queries, HTTP calls, agent harnesses, and other workflow steps.
The MCP server registers `dagu_change` and `dagu_execute` as destructive-capable tools, so require preview/review before applying DAG changes or starting/stopping production runs.
API keys can be scoped to the MCP surface; avoid reusing broad admin credentials for agent access.
Workflow edits may change schedules, parameters, retries, secrets usage, queues, resource limits, notifications, and downstream infrastructure actions.
Keep the Dagu server and MCP endpoint behind trusted network boundaries, TLS, and authentication for shared or remote deployments.
✓Dreamlit MCP is a hosted remote server at `https://mcp.dreamlit.ai/mcp`; the public repository contains setup docs and registry metadata, not the production backend source.
Write scopes can create or update workflow drafts and send workflow tests; publish scopes can publish, schedule, or unpublish live notification workflows.
Publishing is a separate explicit step in Dreamlit's recommended flow; keep a human confirmation gate before `confirm_publish` or `unpublish_workflow`.
Use least-privilege OAuth scopes. Read-only review clients should not receive `workflows:write` or `workflows:publish`.
Test important email or Slack notification drafts before publishing, especially when prompts include personalization rules, timing, timezone, or unsubscribe behavior.
✓The hosted MCP server can execute inference.sh apps, platform tasks, and proxied connector tools that may create, update, or delete data in connected services such as GitHub, Linear, Slack, Notion, or databases.
Bearer API keys grant account-scoped access to platform capabilities; rotate compromised keys immediately and avoid committing tokens to repositories or shared MCP config files.
MCP proxy features can discover and call tools on remote MCP servers through inference.sh, which expands the runtime trust boundary beyond the primary client configuration.
Tool calls may trigger paid inference, connector actions, storage writes, or outbound network requests according to the selected app or connector.
Use least-privilege connector authorization and review each proxied server before enabling it in production agent workflows.
✓mcp-proxy can expose local stdio MCP servers as network services; keep the host bound to `127.0.0.1` unless remote access is intentional.
Passing `--host=0.0.0.0`, permissive CORS, or named-server routes can make tools reachable by other systems on the network.
Proxy configuration can include bearer tokens, OAuth client secrets, headers, server commands, environment variables, and working directories.
The proxy can spawn arbitrary configured MCP server commands; only use trusted command strings and config files.
Remote SSE or Streamable HTTP servers should be authenticated and trusted before forwarding client requests or tool outputs.
Privacy notes
✓DAG specs, run parameters, logs, documents, audit records, secrets references, API keys, environment variables, and workflow outputs may be exposed to the MCP client.
Workflow logs can contain credentials, customer data, internal hostnames, database query results, command output, file paths, or incident context.
Dagu stores state locally by default and can also run distributed workers; review where DAG files, logs, audit entries, and secrets are persisted.
Any workflow state returned through the MCP client may be sent onward to the configured model provider.
✓Dreamlit MCP can expose workflow metadata, saved brand kit summaries, connected project context, preview or builder URLs, and bounded notification analytics.
Analytics access can reveal recipient engagement and workflow run data; filter narrowly and paginate instead of requesting broad reporting dumps.
Do not paste database credentials, raw secrets, private tokens, or integration credentials into prompts or shared MCP configs.
Review Dreamlit, MCP client, AI-provider, and downstream-tool retention policies before using real customer, recipient, or workspace data.
✓Prompts, files, tool arguments, task metadata, connector payloads, and model outputs are processed by inference.sh and may transit connected third-party MCP services.
OAuth-backed connectors can expose account, workspace, issue, message, or repository content to the agent through proxied tool results.
API keys, connector tokens, and task logs should be treated as sensitive credentials and kept out of version control and public issue threads.
Hosted execution may retain usage, billing, and operational telemetry according to inference.sh policies; review the platform privacy documentation before processing regulated data.
✓MCP requests, responses, tool outputs, progress events, headers, OAuth tokens, API access tokens, and session identifiers may pass through the proxy process.
Named server config files can contain command arguments, environment variables, and credentials for downstream MCP servers.
Exposed network endpoints can reveal tool names, server status, and results to clients that can reach the proxy.
Logs and troubleshooting output may include endpoint URLs, command names, headers, connection errors, or server names.
Store config files outside shared repositories when they include tokens or private server details.
Prerequisites
Dagu installed from Homebrew, GitHub Releases, npm, Docker/GHCR, Helm, or another upstream-supported installation path.
A running Dagu HTTP server with the built-in MCP endpoint enabled through the normal server path.
MCP client that supports Streamable HTTP server configuration.
API key with MCP surface access when Dagu authentication is enabled.
Dreamlit workspace and project access for the notification workflows being managed.
MCP client that supports remote Streamable HTTP servers and Dreamlit OAuth, or a client path that can use Dreamlit personal access tokens.
Workspace decision on which scopes to grant, such as `workflows:read`, `workflows:write`, `workflows:publish`, and `analytics:read`.
Human review process for workflow tests, publishing, scheduling, and unpublishing actions.
An inference.sh account and API key from `belt login` or the platform dashboard.
An MCP client that supports streamable HTTP transport, such as Claude Code, Cursor, Cline, or Windsurf.
Review of which inference.sh apps, connectors, and proxy tools the agent may call before enabling write-capable workflows.
A billing and quota plan if the workflow will run image, video, LLM, search, or connector-backed tasks at scale.
Python 3.10 or newer.
uv, pipx, or Docker for installation.
A known MCP endpoint or local stdio MCP server to bridge.
Review of required headers, OAuth client credentials, CORS origins, host, port, and named-server configuration.
Run `belt login` to create an inference.sh API key, then add the streamable HTTP MCP endpoint `https://api.inference.sh/mcp` with `Authorization: Bearer inf_<your_api_key>` in your MCP client settings.